CVE-2021-47860
📋 TL;DR
CVE-2021-47860 is a CSRF vulnerability in GetSimple CMS Custom JS 0.1 plugin that allows unauthenticated attackers to inject malicious JavaScript into administrator sessions. When an authenticated administrator visits a malicious webpage, attackers can execute arbitrary client-side code that may lead to remote code execution on the server. This affects all GetSimple CMS installations using the vulnerable Custom JS plugin.
💻 Affected Systems
- GetSimple CMS Custom JS Plugin
📦 What is this software?
Getsimplecms by Get Simple
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through remote code execution, allowing attackers to install backdoors, steal data, or take control of the hosting environment.
Likely Case
Administrator account takeover, website defacement, data theft, or installation of malicious scripts/backdoors on the server.
If Mitigated
Limited impact with proper CSRF protections, web application firewalls, and administrator awareness training in place.
🎯 Exploit Status
Multiple public exploits exist (Exploit-DB 49712, 49816). Attack requires social engineering to lure authenticated administrator to malicious page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: http://get-simple.info
Restart Required: No
Instructions:
1. Remove the Custom JS 0.1 plugin entirely from your GetSimple CMS installation. 2. Delete the plugin files from the /plugins/customjs/ directory. 3. Clear any cached plugin data from your CMS.
🔧 Temporary Workarounds
Disable Custom JS Plugin
allDeactivate the vulnerable plugin through GetSimple CMS admin interface
Login to GetSimple CMS admin panel > Navigate to Plugins > Find 'Custom JS' > Click 'Deactivate'
Implement CSRF Tokens
allAdd CSRF protection to all admin forms and endpoints
Modify plugin PHP files to include CSRF token validation using GetSimple's security functions
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline scripts and unauthorized sources
- Use web application firewall (WAF) rules to block suspicious POST requests to admin endpoints
🔍 How to Verify
Check if Vulnerable:
Check if /plugins/customjs/ directory exists in your GetSimple installation and contains version 0.1 filesCheck Version:
Check the customjs/plugin.php file for version information or examine GetSimple CMS plugins pageVerify Fix Applied:
Confirm the customjs plugin directory is removed or empty, and check admin interface shows plugin as deactivated/removed📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to admin endpoints without referrer headers
- Multiple failed CSRF token validations
- Unexpected JavaScript file uploads or modifications
Network Indicators:
- Cross-origin requests to admin endpoints from suspicious domains
- POST requests to /admin/load.php?plugin=customjs without proper authentication flow
SIEM Query:
source="webserver" AND (uri="/admin/load.php" AND query="plugin=customjs") AND method="POST" AND NOT referrer CONTAINS "your-domain.com"